Flight Software Research Articles

Analysis of DORIS range-rate residuals for TOPEX/Poseidon, Jason, Envisat and SPOT

Three currently operational radar altimeter satellites are equipped with the Doppler orbitography and radiopositioning integrated by satellite (DORIS) tracking system for precise orbit determination and two more are already foreseen. Any systematic errors in their computed orbits could possibly adversely affect scientific products used in climate change studies, such as sea level and ice sheet heights. DORIS residuals, which can be interpreted as a measure of orbit determination performance, often show systematic errors. We have therefore analyzed long time series of DORIS range-rate residuals in order to investigate possible systematic errors common to all DORIS analysis strategies and software packages, either on a satellite or on a station basis. In particular, the investigation has focused on global DORIS data of six satellites (TOPEX, Jason, Envisat and SPOT-2, -4 and -5) and station-specific data for Fairbanks, Easter Island and Syowa Base. Large measurement errors when crossing the South Atlantic Anomaly are easily detected in the DORIS residuals of Jason, while Envisat residuals show the most prominent evidence of multipath interference and the effect of a flight software update. Particularly, large errors were also found in low-elevation data.

Fault-Detection Design for Uninhabited Aerial Vehicles

Fault Detection (FD) plays a vital role in ensuring the safety of a flight-control system, especially that of an uninhabited aerial vehicle. An FD algorithm is designed to detect a situation in which a faulty condition has occurred in the system. The main theoretical contribution of this work is a new residual threshold function, which is input dependent and enhances the FD capabilities of highly uncertain systems. The combined FD algorithm and new threshold function were simulated in the laboratory, in a high-fidelity hardware-in-the-loop environment, and flight tested as part of the Defense Advanced Research Projects Agency (DARPA) Software Enabled Control (SEC) Program. The DARPA SEC program is a research initiative designed to provide flight-control engineers with a reusable interface for the implementation of flight-control algorithms and flight management software on embedded systems.

Odin two years in-orbit, staying alive and continuously tuned-in

Odin is a Swedish-led, scientific, three-axis stabilised, fine-pointing, small satellite that provides high-quality spectroscopy data in the optical, mm and submm regions. End-users are atmosphere and astronomy scientists in Canada, France, Finland and Sweden. The satellite had in February 2003 accomplished its design goal, two years lifetime in-orbit, and it continues to work well. Satellite parameters as well as operational procedures have been adjusted frequently during the lifetime of Odin. Operational changes and improvements cover almost all areas, like power management, data taking, cooler operation, thermal control, payload configuration and calibration, star tracker handling and, perhaps most important, attitude reference generation. The on-board flight software has on several occasions been updated. Some of the improvements were planned already before launch, while others are a consequence of adapting to gathered experience in-orbit. Today Odin has implemented sophisticated measurement strategies that either increases pointing accuracy or creates more efficient aeronomy research than originally planned for.

The octagon abstract domain

This article presents the octagon abstract domain, a relational numerical abstract domain for static analysis by abstract interpretation. It allows representing conjunctions of constraints of the form ± X ± Y ≤ c where X and Y range among program variables and c is a constant in ℤ, ℚ, or ℝ automatically inferred. Abstract elements are represented using modified Difference Bound Matrices and we use a normalization algorithm loosely based on the shortest-path closure to compute canonical representations and construct best-precision abstract transfer functions. We achieve a quadratic memory cost per abstract element and a cubic worst-case time cost per abstract operation, with respect to the number of program variables.In terms of cost and precision, our domain is in between the well-known fast but imprecise interval domain and the costly polyhedron domain. We show that it is precise enough to treat interesting examples requiring relational invariants, and hence, out of the reach of the interval domain. We also present a packing strategy that allows scaling our domain up to large programs by tuning the amount of relationality. The octagon domain was incorporated into the ASTRÉE industrial-strength static analyzer and was key in proving the absence of run-time errors in large critical embedded flight control software for Airbus planes.

Flood detection and monitoring with the Autonomous Sciencecraft Experiment onboard EO-1

In this paper, we present a new way of detecting and monitoring flooding through the Autonomous Sciencecraft Experiment (ASE) [Chien, S. T., Debban, C., Yen, R., Sherwood, R. Castano, B., & Cichy, A. G. et al. (2001). ASC Science Study Report, available from http://ASE.jpl.nasa.gov], which is part of the Space Technology 6 effort under NASA's New Millennium Program. Recent autonomy experiments conducted on Earth Observing 1 (EO-1) using the ASE flight software have demonstrated the ability of several science algorithms to successfully classify key features including flood-induced changes, in hyperspectral images captured by the EO-1 Hyperion instrument. Furthermore, onboard science analysis on the classified images has been performed, and then used to modify an operational plan without interaction from the ground (Sherwood, R., Chien, S., Tran, D., Cichy, B., Castano, R., Davies, A., et al. (2004). Preliminary results of the autonomous sciencecraft experiment. In: Proceedings of the IEEE Aerospace Conference, Big Sky, MT). These algorithms are used to downlink science data only when change occurs, and to detect features of scientific interests such as flooding, volcanic eruptions, and the formation and breakup of sea ice. The purpose of this paper is to demonstrate the success of ASE and its implications on detecting, mapping, and monitoring transient processes such as flooding autonomously from space. Mapping of water inundation and its change through time is part of our focus in studying transient processes from space. In 2004, hyperspectral data were acquired from the Hyperion instrument for target areas around the world that have a high potential for flooding to develop and test floodwater classifiers. In addition, classifier thresholds were determined from both normal flows and possible flood conditions. The paper introduces the development, testing, and success of the ASE software in detecting and reacting to flooding in near real-time. ASE is now operational and flight-tested, and, thus, ready to use for space-borne reconnaissance. Successful demonstration of the floodwater classifiers includes the capture of a rare flooding event of the Australian Diamantina River during ground testing in February 2004, and the detection of flood-related changes along the Brahmaputra River in Bangladesh and the Yukon River in Alaska during onboard testing on EO-1 in 2005. Both of these detections led to triggered responses onboard the spacecraft, which included acquiring additional Hyperion scenes. These results pave the way for future smart reconnaissance missions of transient processes on Earth and beyond. It is hoped that ASE will become a default in future missions to increase the science return by introducing spacecraft autonomy for detection and monitoring of science events, which otherwise would be discovered too late or altogether missed.

Anomaly Trends for Long-Life Robotic Spacecraft

Three unmanned planetary spacecraft to the outer planets have been controlled and operated successfully in space for an accumulated total of 68 years. The Voyager 1 and 2 spacecraft each have been in space for more than 27 years. The Galileo spacecraft was in space for 14 years, including eight years in orbit about Jupiter. During the flight operations for these missions, a total of 3300 anomalies for the ground data and the flight systems have been tracked using the Jet Propulsion Laboratory’s anomaly reporting tool. Methods and results are described for classifying and identifying trends relative to ground system vs flight system, software vs hardware, and corrective actions. Several lessons learned from these assessments can significantly benefit the design and planning for long-life missions of the future. These include the necessity for redundancy to ensure successful operation of the spacecraft, awareness that anomaly reporting is dependent on mission activity not the age of the spacecraft, and the need for having a program to maintain and transfer operation knowledge and tools to replacement flight team members. PERATING long-life interplanetary spacecraft involves the monitoring of spacecraft functionality for both nominal and anomalous behavior. During flight operations for the Voyager and Galileo spacecraft, a total of 3300 anomalies has been tracked using the Jet Propulsion Laboratory’s anomaly reporting tool for ground data and flight systems operations. These anomalous events require evaluation for the proper response required to ensure the continuation of the spacecraft’s mission. For this study, a long-life spacecraft is defined as one designed to function reliably for 10 or more years in the space environment. Although not specifically designed as such, the Voyager and Galileo spacecraft can be viewed as prototypes of long-life spacecraft because of their successful operation spanning several decades. The two Voyager spacecraft launched in 1977 have successfully completed flybys of several outer planets and now are leaving our solar system and flying trajectories taking them into interstellar space. Based on current consumables usage and continued mission operations attention, the spacecraft are expected to continue to return data until 2020. The Galileo orbiter was launched in 1989 and orbited Jupiter from 1995 to 2003 when it was intentionally impacted into the atmosphere of Jupiter just before its consumables were depleted.

File-based data processing on MESSENGER

As part of the system software, MESSENGER will be using a file-based system for the transfer and processing of instrument and spacecraft data. The flow of files within the MESSENGER software architecture begins with the receipt of science data by the main processor and the creation of files containing these data by the flight software. The files are then autonomously selected for downlink via a priority-based algorithm, packaged for transmittal via the CCSDS File Delivery Protocol (CFDP), and radiated to the ground. The ground software reconstructs the files via its implementation of CFDP, performs further processing on the file, and sends it to the operations data archive and the Science Operations Center. The MESSENGER spacecraft operations team manages the overall handling of these files through interaction with both the flight and ground systems.

디바이스 데이터 입출력에 있어서 폴링 방식과 인터럽트 구동 방식의 데이터 처리 방법

실시간 선점형 다중 태스크 운영체제를 기반으로 구동하는 프로세서와 연결된 디바이스로부터 데이터를 입수하는 방법은 크게 폴링(Polling)과 인터럽트 구동(Interrupt driven) 방식으로 구분할 수 있다. 이들 모두에 대한 기술적인 접근은 운영체제의 스케줄링 정책 및 소프트웨어 아키텍쳐에 따라 달라질 수 있다. 위성 컴퓨팅 환경에서 위성 서브 시스템 또는 컴포넌트로부터 입수되는 데이터의 처리시 시간 준수와 정확성을 보장하는 것은 비행 소프트웨어를 개발시마다 요구되는 중요한 요구사항 중의 하나이다. 본 논문에서는 디바이스의 입출력 방식과 스케줄링과의 관계에 대한 분석 및 이에 따른 프로세서와 디바이스간의 신뢰적인 데이터 입출력 방법을 제안한다. The methods that are used for receiving data from attached devices under real-time preemptive multi-task operating system (OS) by general processors can be categorized as polling and interrupt driven. The technical approach to these methods may be different due to the application specific scheduling policy of the OS and the programming architecture of the flight software. It is one of the most important requirements on the development of the flight software to process the data received from satellite subsystems or components with the exact timeliness and accuracy. This paper presents the analysis of the I/O method of device related scheduling mechanism and the reliable data I/O methods between processor and devices.

Injection of new technology into space systems

Small satellite systems appear to be antithetical to human spaceflight systems and flagship robotic satellite systems: Small satellite missions have more focused scientific objectives, lower cost, far less complexity, and shorter development and deployment schedules. The shorter schedules offer an opportunity for injecting new technology into their design as a means for keeping costs and schedule under control, for enabling cost-effective operations, and for taking advantage of innovative ideas. It is often the case that small satellite missions benefit from technologies specifically targeted for their application, but benefits may also be realized by adopting or injecting technologies originally developed for human spaceflight systems, especially if these technologies were conceived using multi-use and multi-disciplinary development principles. In this paper, the authors discuss the precedent of injecting new technology developed for human spaceflight systems into small satellite missions. More importantly, the authors will present five new technologies recently proposed for making the NASA Space Shuttle safer to fly, all of which are directly applicable to small satellite mission design and operations. The technologies, when matured, will provide a means to create new generations of ultra-reliable flight hardware and software. The technologies are all currently at the developmental phase and require modest investment to achieve operational status.

Design, Implementation, and Validation of KOMPSAT-2 Software Simulator

In this paper, we present design features, implementation, and validation of a satellite simulator subsystem for the Korea Multi-Purpose Satellite-2 (KOMPSAT-2). The satellite simulator subsystem is implemented on a personal computer to minimize costs and trouble on embedding onboard flight software into the simulator. An object-oriented design methodology is employed to maximize software reusability. Also, instead of a high-cost commercial database, XML is used for the manipulation of spacecraft characteristics data, telecommand, telemetry, and simulation data. The KOMPSAT-2 satellite simulator subsystem is validated by various simulations for autonomous onboard launch and early orbit phase operations, anomaly operation, and science fine mode operation. It is also officially verified by successfully passing various tests such as the satellite simulator subsystem test, mission control element system integration test, interface test, site installation test, and acceptance test.

An approach to the measurement of software evolution

AbstractOur current work involves developing methods of measuring changes to evolving software systems. We study a system's change characteristics over a large number of builds using the distinct sources of variation in the software metrics used to measure the system.We have been collaborating with a flight software technology development effort at the Jet Propulsion Laboratory (JPL) and have progressed in resolving the limitations of our earlier work in two distinct steps. First, we have developed a repeatable and consistent fault enumeration methodology, allowing them to be precisely and accurately measured. Second, we have developed a practical framework for automating fault measurement, which we applied to the JPL software system during its development. Every change to the system was measured and every identified fault was tracked to a specific code module.Our analysis indicates that measures of the evolving system's structure are strongly related to the number of faults inserted during its development, and that some types of change are more likely to result in the insertion of faults than others. The fault enumeration methodology ensures that the resulting fault model has greater predictive validity; it also provides a higher quality model than other popular definitions of a fault. Copyright © 2005 John Wiley & Sons, Ltd.

Crashproof codes [flight software

Boeing Co. and NASA have joined forces for the Active Aeroelastic Wing (AAW) Project to test the way a modified F/A-18 strike fighter uses its wings. The AAW was designed to be flexible enough to be twisted on demand in flight and it could herald nothing less than a revolution in aviation. The twisting can be used to control the plane's roll, reducing and ultimately eliminating the need for ailerons and flaps and their associated hardware. AAW-equipped planes would result to increased fuel efficiency and improved maneuverability, able to execute sharper turns at higher speeds. A special flight software was developed to keep track of the plane's speed, altitude, and attitude while monitoring the pilot's controls for commands. Based on a set of rules known as control laws, the software must then translate any commands from the pilot into movements of the aircraft's various control surfaces such as the rudders or, most significantly, the flaps that flex the AAWs. Despite its complex and critical job, the flight software is compact, consisting of only about 13,000 lines of source code written in the Ada language.

Design and Performance of Tip-Tilt Mirror System for Solar Telescope

The tip-tilt mirror (TTM) system was developed for the extreme ultraviolet (XUV) Cassegrain telescope aboard the Institute of Space and Astronautical Science sounding rocket. The spatial resolution of the telescope is about 5 arcsec, whereas the rocket pointing is only controlled to be within ±0.5 deg of the target (sun) without additional stability control. To stabilize the XUV image within about 5 arcsec on the focal plane, the TTM system controls the tilt of the secondary mirror with two-axis fixed-coil magnetic actuators. The TTM system has a wide tilt angle and can drive the large secondary mirror at high frequency. The two position-sensitive detectors, one placed in the telescope and the other in the TTM mechanical structure, are used for closed-loop control of the TTM. The closed-loop control system, which has command and telemetry, is executed by the flight software on the digital signal processor. The TTM has a launch-lock mechanism to protect against launch vibrations up to about 16G. The sounding rocket was launched from the Kagoshima Space Center on 31 January 1998. The TTM worked perfectly during the flight and achieved better than the expected 5-arcsec stability on the focal plane during CCD charge-coupled device exposures.

Experimental Evaluation of Verification and Validation Tools on Martian Rover Software

We report on a study to determine the maturity of different verification and validation technologies (V&V) applied to a representative example of NASA flight software. The study consisted of a controlled experiment where three technologies (static analysis, runtime analysis and model checking) were compared to traditional testing with respect to their ability to find seeded errors in a prototype Mars Rover controller. What makes this study unique is that it is the first (to the best of our knowledge) controlled experiment to compare formal methods based tools to testing on a realistic industrial-size example, where the emphasis was on collecting as much data on the performance of the tools and the participants as possible. The paper includes a description of the Rover code that was analyzed, the tools used, as well as a detailed description of the experimental setup and the results. Due to the complexity of setting up the experiment, our results cannot be generalized, but we believe it can still serve as a valuable point of reference for future studies of this kind. It confirmed our belief that advanced tools can outperform testing when trying to locate concurrency errors. Furthermore, the results of the experiment inspired a novel framework for testing the next generation of the Rover.

Precise and efficient static array bound checking for large embedded C programs

In this paper we describe the design and implementation of a static array-bound checker for a family of embedded programs: the flight control software of recent Mars missions. These codes are large (up to 280 KLOC), pointer intensive, heavily multithreaded and written in an object-oriented style, which makes their analysis very challenging. We designed a tool called C Global Surveyor (CGS) that can analyze the largest code in a couple of hours with a precision of 80%. The scalability and precision of the analyzer are achieved by using an incremental framework in which a pointer analysis and a numerical analysis of array indices mutually refine each other. CGS has been designed so that it can distribute the analysis over several processors in a cluster of machines. To the best of our knowledge this is the first distributed implementation of static analysis algorithms. Throughout the paper we will discuss the scalability setbacks that we encountered during the construction of the tool and their impact on the initial design decisions.

The Mars exploration rovers descent image motion estimation system

Descent image motion estimation system is the first machine-vision system for estimating lander velocity during planetary descent. Composed of sensors and software, DIMES features a descent imager, a radar altimeter, an inertial-measurement unit, and an algorithm for combining sensor measurements to estimate horizontal velocity - the speed across the planet's surface the lander travels as it descends. Although the sensors are not novel technology, the algorithm and flight software that combines them are new. This algorithm combines radar, image, and inertial data in a novel way to create a low-cost, robust, and computationally efficient solution to the horizontal-velocity-estimation problem. This article describes the DIMES algorithm, its testing, and its performance during both Mars exploration rover landings.

Communication "Tones" and Their Use as Reliability Assessment Tools in High Risk Aerospace Maneuvers

he success of the Mars Exploratory Rovers, Spirit and Opportunity, has pleased many in the scientific community. The findings concerning the past and present Mars environment and geology continue to impress scientists of many professional backgrounds. For engineers however, the success of these two spacecraft is more related to the fact that they were able to survive all the perils in these missions. It also confirms the need for a lot of hard work, such as establishing reliability assessment tools that allow us to measure, quantitatively and qualitatively, the health of the spacecraft. One such assessment tool is the design and development of hardware and software functionalities, within the spacecraft telecommunication subsystem, which will transmit “tones” upon the successful completion of each of the many high-risk maneuvers in the last ten minutes of the flight (descent and landing). It is known from past experience, that most U.S. missions to Mars have failed in the last ten minutes of the flight. This timeframe is known as the “ten minutes of terror,” and accounts for all the descent and landing maneuvers the spacecraft needs to make for a successful landing. A single failure in any of these maneuvers (more than 20 which are fully automated) would be catastrophic. In 1999 the Mars Polar Lander, a three-legged spacecraft, rather than a rover, failed in its attempt to land on Mars’ south pole. The mission was going well until the last ten minutes —the start of the descent and landing phase of the mission. In the last ten minutes of the flight, the spacecraft rotates into its attitude for entry into the Mars atmosphere. The fiery descent is the start of the ten minutes of terror. We never knew for certain what maneuver failed during the descent and landing of the Mars Polar Lander. A later failure investigation determined that a software error cut off the descent engines prematurely during the last maneuver and caused the spacecraft to crash land during the last 500 m. However, it is also possible that the failure occurred earlier, but we will never know. From an engineering point of view it is necessary to understand the failure mechanisms during these critical mission events in order to improve the reliability of subsequent spacecraft. Therefore, it is important to know when a failure occurs (i.e. which critical maneuver and at what time), and how did it occur. During the last ten minutes there is no spacecraft telemetry, the spacecraft transponder is switched to a carrier-only mode. Sometimes major events can be detected during the descent through a Doppler shift in the carrier frequency (e.g. during the descent the spacecraft velocity is reduced from 30,000+ miles/hour to about 7000 miles/hour). However, many small events will go undetected. Any failure in these small events could be catastrophic. How can we assure ourselves that a particular event, small or large, was completed successfully? Or from a failure analysis point of view, if a failure occurred, in a particular maneuver, can we associate that maneuver with a given event in the descent and landing timeline? If so, we will know with some confidence the hardware or software responsible for a given failure and how to improve its reliability the next time around. (Notice that Spirit and Opportunity spacecraft were launched within 24 days of each other). The spacecraft deep space transponders were designed to accommodate the additional feature of a tone mode. The X-band transponder will transmit a tone every time a successful event is accomplished. The very weak tones will be captured by the very large diameter dish antennas of the deep space network, located in New Mexico, Spain, and Australia. The failure to transmit or receive a tone will indicate that the particular maneuver or event may have failed. Fault management software is synchronized with the flight software such that failures, or lack of failures, detected by fault management software will translate into executable commands by the flight software to activate the tone mode feature in the X-band deep space transponder. A hardware interface was developed in the deep space transponder to accommodate this particular type of command from the flight software.

KSR-III 과학로켓의 자세제어기 설계와 비행시험

KSR-III 로켓은 액체추진 엔진을 사용한 과학로켓이며, 추력 비행중 피치 및 요 자세제어를 위해 추력벡터제어 방식을 사용하고, 롤 자세를 제어하기 위해 냉가스 추력기를 사용하였다. 본 논문은 KSR-III 로켓의 3축 자세제어를 위해 설계된 자세제어기의 구조와 이득 스케쥴링, 자세 안정성 분석결과에 대해 소개한다. 설계된 자세제어기는 국산화 개발된 관성 항법시스템의 비행소프트웨어로 구현되었는데 비행시험에서 완벽히 작동하였다. 비행에서 측정된 데이터는 시뮬레이션 결과와 거의 일치되었다. The KSR-III rocket is a liquid propellant sounding rocket and thrust vector control actuators and cold gas thrusters are used to control pitch and yaw, roll attitude respectively during thrusting phase. In this paper, the structure of designed attitude controller and gain scheduling, results of stability analysis for KSR-III rocket are presented. The attitude controller is implemented with flight software in the domestically developed INS and successfully performed its function in the flight test. The flight data are coincident with simulation results.

Step proof mass dynamics

The Satellite Test of Equivalence Principle (STEP) is a joint European–US project to investigate one of the most fundamental principles in physics, the Equivalence of inertia and passive gravitational mass. As STEP matures into a flight program, the development of a precise spacecraft dynamics simulator becomes crucial. The simulator is primarily needed for design, test and verification of the drag-free control (DFC) system and the flight software. The drag-free concept involves centering the proof mass located inside a satellite. As the proof mass is free of external disturbances (drag free), it follows a purely gravitational orbit. Since the satellite is forced to follow the proof mass, it too follows the same gravitational orbit, canceling all non-gravitational forces. For the STEP Mission, the DFC system is required to attenuate any disturbance forces acting on the spacecraft to achieve residual acceleration at location of the accelerometer of less than 3×10 −14 m/s 2 (rms) across the measurement bandwidth. While the simulator is based on a high-fidelity six-degree-of-freedom numerical simulation, a simplified model is used to analyze the proof mass dynamics. The stability analysis of the proof mass motion is performed by transformation of the simplified model into the standard form of the Mathieu differential equation. The stability regions of the solution are applied to choose proper values for parameters like coupling forces between satellite and proof mass as a function of spacecraft rotation. The paper describes the calculation of the spacecraft/payload dynamics and the assumptions used to derive the underlying algorithms with a special emphasis on numerical precision issues.

NICMOS Coronagraphy

ABSTRACTThe NICMOS coronagraphic capability is a unique resource. It has been used to search for and/or confirm the presence of planetary or brown dwarf companions around nearby stars, to probe the structure of circumstellar disks, and to study the host environment of quasars with damped Lyα systems. These and other programs are expected to continue with NICMOS, using the recently installed NICMOS cooling system. In this paper we present an operational overview of NICMOS coronagraphy from its inception on 1998 February 6 through 1998 December 18. During this time interval, which corresponds to H ubble Space Telescope (HST) cycles 7 and 7N, coronagraphic observations of 329 targets for 22 programs were obtained. The flight software was enhanced to locate the position of the hole as well as the target during onboard acquisitions. Coronagraphic images are affected by changes in the point‐spread function (PSF) due to thermally induced HST focus changes, NICMOS cold‐mask movement, and light scatter around the coronagraphic hole. Proper PSF subtraction requires a well‐planned observing strategy that is appropriate for the target, and a matched PSF target. For example, for point sources, observations with the same filter taken back‐to‐back in the same orbit with a roll of the spacecraft between observations yields good results. For circumstellar disks, contemporaneous observations of a matched PSF target are required.